How hackindiaxyz/hackindia-spark-10-uttarakhand-north-region-head-hunters works
CHITRAGUPT is a cyber-forensics investigation framework: an investigator selects a case, uploads CSV or Windows Event XML evidence, and uses the dashboard to review events, anomalies, findings, and reports. The documented investigation stages include parsing and normalization, evidence storage, search, feature extraction, detection, correlation, inference, and reporting. Sampled code confirms ingestion formats, pipeline orchestration, and evidence integrity checks; unsampled endpoint internals and several documented capabilities are represented at the subsystem level, with uncertain wiring omitted.
Main entry points: pipeline.py Pipeline Orchestrator · main.py FastAPI API · database.py Database Sessions · App.jsx Investigation Dashboard
Components 19
Evidence Intake
- CSV Ingestion
backend/app/ingestion.py - Windows XML Ingestion
backend/app/windows_event_ingestion.py - Evidence Integrity
backend/app/evidence_storage.py
Investigation Analysis
- Pipeline Orchestrator
backend/app/pipeline.py - Feature Extraction
backend/app/features.py - Scenario Rules
backend/app/rules.py - Isolation Forest
backend/app/anomaly.py - Local Outlier Factor
backend/app/lof.py - Event Correlation
backend/app/correlation.py - Finding Inference
backend/app/inference.py
API and Persistence
- FastAPI API
backend/app/main.py - Database Sessions
backend/app/database.py - Case and Event Models
backend/app/models.py
Investigation Review
- Investigation Dashboard
frontend/src/App.jsx - React Entry
frontend/src/main.jsx - Report Generation
backend/app/reporting.py
Other components
- Investigator
- Ollama Service
- PostgreSQL
Connections 20
- Investigator → Investigation Dashboard: uses
- React Entry → Investigation Dashboard: renders
- Investigation Dashboard → FastAPI API: HTTP requests
- FastAPI API → CSV Ingestion: parses CSV
- FastAPI API → Windows XML Ingestion: parses XML
- FastAPI API → Evidence Integrity: retains or verifies
- FastAPI API → Pipeline Orchestrator: starts analysis
- Pipeline Orchestrator → Feature Extraction: extracts features
- Pipeline Orchestrator → Scenario Rules: evaluates rules
- Pipeline Orchestrator → Isolation Forest: detects anomalies
- Pipeline Orchestrator → Local Outlier Factor: detects anomalies
- Pipeline Orchestrator → Event Correlation: correlates events
- Pipeline Orchestrator → Finding Inference: infers findings
- FastAPI API → Report Generation: generates reports
- FastAPI API → Ollama Service: requests explanation
- FastAPI API → Database Sessions: opens sessions
- Pipeline Orchestrator → Database Sessions: loads case events
- Evidence Integrity → Database Sessions: loads evidence hash
- Database Sessions → PostgreSQL: queries and persists
- Case and Event Models → PostgreSQL: maps records